Lead Cyber Threat Intelligence Analyst

Role Summary : We are seeking a Lead CTI Analyst to work as a Cyber Threat Intelligence (CTI) domain SME supporting AI-driven automation of cybersecurity use cases. The role will focus on CTI data collection, analysis, curation, normalization, enrichment, and quality validation to build high-quality datasets and knowledge sources for AI automation, LLM/RAG solutions, and cybersecurity analytics. The role is for a Lead Engineer who will provide technical leadership, mentor and manage team members, guide solution design and implementation, and ensure timely delivery of project outcomes. Responsibilities : - Act as a Cyber Threat Intelligence (CTI) domain SME for AI automation of cybersecurity use cases. - Collect, analyze, validate, curate, and normalize CTI data from open-source, commercial, and internal sources to support AI automation. - Apply CTI analysis frameworks such as the CTI lifecycle, Diamond Model, Cyber Kill Chain, and Analysis of Competing Hypotheses (ACH) to structure and assess intelligence. - Perform MITRE ATT&CK mapping and maintain contextual relationships between threat actors, campaigns, malware, vulnerabilities, techniques, and indicators. - Handle IoCs using industry best practices, including defanging, hash-type identification, contextual validation, deduplication, and false-positive avoidance. - Work with TLP 2.0 and PAP markings and ensure appropriate handling and dissemination of CTI data. - Create, validate, and enrich STIX 2.1 objects and support TAXII 2.1-based CTI exchange and ingestion workflows. - Operate and manage CTI platforms such as MISP and OpenCTI, including data models, APIs, feed management, PyMISP, and GraphQL. - Use CTI enrichment services such as VirusTotal, URLScan, AbuseIPDB, Shodan, Censys, OTX, Whois, and PassiveDNS to enrich and validate indicators and entities. - Apply OSINT tradecraft and security fundamentals while maintaining appropriate operational security (OPSEC). - Support the creation of high-quality, traceable, and reusable CTI datasets for LLM fine-tuning, RAG, automated analysis, and other AI-driven cybersecurity applications. - Manage the team of junior analysts and provide technical guidance. - Collaborate with cybersecurity, data, AI/ML, and engineering teams to translate CTI analyst knowledge into structured data, rules, prompts, evaluation datasets, and automation workflows. - Stay current with emerging threats, vulnerabilities, threat actor activity, malware, and CTI analysis methodologies. Communication and Documentation : - Excellent written and oral communication, presentation, listening and interpersonal skills. - Collaborating effectively with internal and external team. - Excellent reporting, time management, analytical & communication skills. Preferred Skills : - Experience with commercial Cyber Threat Intelligence (CTI) platforms and vendors. - Familiarity with detection rule standards such as YARA, Sigma, Snort, and Suricata. - Exposure to AI/ML, LLM, RAG, data curation, or cybersecurity automation use cases. - Surface-level malware analysis and DFIR fundamentals. - Knowledge of cloud security concepts. - Certifications such as GCTI, GCIH, GCFA, CTIA, eCTHPv2, OSCP, or equivalent would be good to have. Qualifications and Technical Skills : - 4 - 6 years of previous experience in Cyber Threat Intelligence, threat research, security analysis, or a related cybersecurity domain. - Strong knowledge of CTI analysis frameworks including CTI lifecycle, Diamond Model, Cyber Kill Chain, and ACH. - Hands-on experience with MITRE ATT&CK mapping, TLP 2.0/PAP marking, STIX 2.1/TAXII 2.1, and IoC handling best practices. - Experience with OSINT tradecraft, security fundamentals, and OPSEC principles. - Hands-on experience with MISP and/or OpenCTI, including data models, APIs, PyMISP, GraphQL, and feed management. - Experience using CTI enrichment tools/services such as VirusTotal, URLScan, AbuseIPDB, Shodan, Censys, OTX, Whois, and PassiveDNS. - Good understanding of detection content standards including YARA, Sigma, Snort, and Suricata. - Python knowledge, preferably with libraries such as stix2, PyMISP, taxii2-client, and vt-py. - Working knowledge of SQL and one or more security query/search languages such as KQL, SPL, or Elastic DSL. - Strong analytical, troubleshooting, problem-solving, and data-curation skills.